CVE-2025-60796

phpPgAdmin 7.13.0 and earlier contains multiple cross-site scripting (XSS) vulnerabilities across various components. User-supplied input from $_REQUEST parameters is reflected in HTML output without proper encoding or sanitization in multiple locations including sequences.php, indexes.php, admin.php, and other unspecified files. An attacker can exploit these vulnerabilities to execute arbitrary JavaScript in victims' browsers, potentially leading to session hijacking, credential theft, or other malicious actions.

• CWE-79

• https://github.com/phppgadmin/phppgadmin/blob/master/admin.php#L35Product
• https://github.com/phppgadmin/phppgadmin/blob/master/indexes.php#L29Product
• https://github.com/phppgadmin/phppgadmin/blob/master/sequences.php#L316Product
• https://github.com/pr0wl1ng/security-advisories/blob/main/CVE-2025-60796.mdThird Party Advisory

Published

Nov 20, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-60786A Zip Slip vulnerability in the import a Project component o…8.8
• CVE-2025-60787MotionEye v0.43.1b4 and before is vulnerable to OS Command I…7.2
• CVE-2025-6079The School Management System for Wordpress plugin for WordPr…8.8
• CVE-2025-60790ProcessWire CMS 3.0.246 allows a low-privileged user with la…6.5
• CVE-2025-60791Easywork Enterprise 2.1.3.354 is vulnerable to Cleartext Sto…6.2
• CVE-2025-60794Session tokens and passwords in couch-auth 0.21.2 are stored…6.5
• CVE-2025-60797phpPgAdmin 7.13.0 and earlier contains a SQL injection vulne…6.5
• CVE-2025-60798phpPgAdmin 7.13.0 and earlier contains a SQL injection vulne…6.5
• CVE-2025-60799phpPgAdmin 7.13.0 and earlier contains an incorrect access c…6.1
• CVE-2025-6080The WPGYM - Wordpress Gym Management System plugin for WordP…8.8
• CVE-2025-60800Incorrect access control in the /jshERP-boot/user/info inter…7.5
• CVE-2025-60801jshERP up to commit fbda24da was discovered to contain an un…8.2